Your privacy matters

Who we are

Vidreno is operated by Massive Monkey Ltd., a company registered in the Isle of Man ("Vidreno", "we", "us"). We are the data controller for the personal data described in this policy. Vidreno has two products: Video Hosting, which hosts videos that creators embed on their own websites and apps, and Vidreno on Demand, where filmmakers sell and rent films. This policy covers both, the vidreno.com website, the help centre, the embedded player, the Vidreno apps (the desktop app for macOS and Windows, the Apple TV app and the mobile apps for iOS and Android, and any other native apps we release) and connections from AI assistants.

On this page: what we collect · how we use it · who receives it · how long we keep it · AI assistants · cookies and local storage · your choices and controls · security · children · international transfers · contact.

Information we collect

What we hold depends on how you use Vidreno. We never ask for more than the product needs, and we do not buy data about you from anyone else.

Creators (Video Hosting accounts)

• Account details: email address, username, and a one-way hash of your password (we cannot read the password itself). Optionally a first and last name and a profile picture.
• Your content: the videos you upload, their titles, descriptions, thumbnails, categories, player colour, public/private setting, file sizes and durations, and the brand colour and settings you choose for your player.
• Plan and billing identifiers: your plan, storage and bandwidth usage, and the customer and subscription references issued by our payment provider. Card and bank details used to pay us never reach Vidreno (see who receives your data).
• Payout details, if you join the earnings programme: your PayPal email address, or for bank transfers the account holder name, bank name, country and the last four digits of the account number. Full account and routing numbers are stored encrypted and are only decrypted to make a payout.
• Earnings and usage: view counts per video and per day, ad earnings, payout requests and their status, and the storage and bandwidth your videos consume.

Advertisers

• The same account details as creators, plus your campaigns, the banner images and text you upload, the destination URLs for clicks, your credit balance, and the references for the credit packs you buy.
• Per-campaign impression and click counts, so you can see how your ads perform. The viewer-side records behind those counts are described under viewers.

On Demand buyers

• An email-only account (no password: you sign in with a code or link sent to your email), your purchases and rentals, rental windows, the order and checkout references from our payment provider, and any comments you post on a film. Pressing Subscribe on a filmmaker's page while signed out creates the same kind of email-only account.
• Subscriptions to filmmakers: which filmmakers you subscribe to, when you subscribed, when you last opened your Subscriptions page (so new films can be marked as new), and for each film a subscribed filmmaker publishes a delivery record (which film, which subscriber, whether the new-film email was sent, when, and any send error). Filmmakers see how many subscribers they have, how many joined in the last 30 days and how many subscribers each film was sent to; they never see who subscribes.
• Streams: when you play a rented or purchased film we record which film and which order is streaming, a one-way hash of your IP address and browser details, and when the stream started, was last seen and ended, so that each rented or purchased film plays in one place per account at a time (a second play of the same film is refused while the first is active). These records are tied to your order and are deleted with it; they are never shown to the filmmaker.

Protected playback (FairPlay and Widevine)

This subsection describes what will happen when protected playback launches; it does not apply until then. Protection is a per-film choice made by the filmmaker: it applies only to films whose filmmaker has turned protection on, and films left unprotected are not affected by anything in this subsection. A protected film on Vidreno on Demand will be delivered with digital rights management: Apple FairPlay Streaming on Apple devices (macOS, iOS, iPadOS and Apple TV) and Google Widevine on other operating systems and browsers (such as Windows, Android and Chrome).

• Playback-licence requests: when a protected film starts, the player asks Vidreno's licence server for a playback licence (the key that unlocks the film on that device). The licence server receives which film is being played, the account or entitlement (rental or purchase) that allows it, and the licence request generated by the device's DRM module. That request is opaque to us but can contain a DRM device identifier or device certificate, which identifies the device's DRM module rather than you. We use it to issue the key to that device only, to enforce the one-place-per-film rule and to detect abuse.
• Where the request goes: on Apple devices a FairPlay key exchange runs between the device and Vidreno's licence server only; nothing is sent to Apple. On other platforms a Widevine licence may be issued through a third-party licence-service provider acting on our behalf (we will name it here when it is chosen, before protected playback launches), and the first time a device plays protected content its Widevine module may contact Google to be provisioned, which is handled by the device under Google's privacy policy.
• How long we keep them: licence-request records (film, entitlement, the device identifier or certificate from the request and the time) will be deleted after 30 days, like view records. Aggregate counts remain.

Filmmaker profiles and crew credits

• Public profile: a filmmaker profile is a Films feature. At sign-up you choose between Host & Embed and Publish films: accounts that choose Publish films (from October 2026) start with the profile on; accounts that choose Host & Embed, and accounts created earlier, start with it off. Hosted videos are never shown on a profile, and switching between the two products in the app never turns the profile on or off; it can be switched on or off at any time on the Profile page. While it is on, the display name, username, avatar, roles, bio, location, website and social links you enter, together with your published films and the crew credits you accepted, are published at vidreno.com/filmmakers/<username> and in the page's structured data, so search engines and anyone with the link can see them; the page is included in our sitemap once it lists a published film or an accepted credit. Switch the profile off and the page stops being served; search engines drop it on their next crawl.
• Crew credits: the role and name a filmmaker enters for each person credited on a film are shown on the film's public page. A credit can be linked to a Vidreno account, which the credited person can accept, unlink or decline at any time.
• Invite emails: when a filmmaker credits someone by email address, we store that address with the credit and, when the filmmaker chooses to, send one invite email through our email provider containing the filmmaker's name, the film's title and the role. The email carries a single-use link that expires after 30 days and a "not me" link that declines without creating an account. We cap invites per account per day and do not send the same film's invite to the same address more than once a day. The invited address is only visible to the filmmaker who entered it; it is never shown publicly. If you are not on Vidreno and do not want further invites for a credit, use the decline link in the email.

Viewers of embedded and hosted videos

You do not need an account to watch a video embedded on a creator's site or sold On Demand. When a video plays we record:

• A salted one-way hash of your IP address and a second hash of your IP address, browser details and a random viewer identifier. Your actual IP address is not stored in these records and the hashes cannot be reversed into it.
• A random viewer identifier in a cookie called vid_viewer that lasts one year. The player also keeps a copy of the same identifier in your browser's local storage, so that a video embedded on another site still counts you as one viewer when your browser does not send our cookie to that site.
• Which video played, how many seconds were watched, when, and whether an ad was shown or clicked.

These records exist solely to count unique views, pay creators and advertisers correctly and detect fraudulent plays. They are deleted after 30 days; only aggregate counts remain.

Support contacts

• When you use the contact form, the help widget or the ticket centre: your name, email address and message. Signed-in users are identified to the ticket centre by their account email so replies reach the right person.

AI assistant connections

• For each app you connect: the app's name, the permissions you approved, when you connected and when it was last renewed, and one-way hashes of the tokens the app uses. Full details are in Connections to AI assistants.

Technical data and metadata

• Request logs: like any web service, our servers and content delivery network see your IP address, browser type, the pages and files requested and timestamps. We use them to run, secure and debug the service and to apply rate limits.
• Timestamps: we record when accounts are created, when videos are uploaded, viewed and changed, when payments and payouts happen and when AI apps connect and act.
• Error reports: if the app hits an error in your browser, a report with the error, the page you were on, your browser type and network address is sent to our error-monitoring provider.

How we use it

• To provide the service: storing and delivering your videos, running your player, selling and delivering films, and letting connected AI assistants act on your instructions.
• To count views and pay people: turning plays into verified view counts, ad impressions and clicks, creator earnings, film sales and payouts.
• To bill you: running subscriptions, add-ons, credit packs and purchases through our payment provider, and enforcing plan limits.
• To keep the platform safe: detecting fraudulent views and clicks, rate-limiting abuse, checking uploads for likely copyright problems, and securing accounts.
• To communicate with you: sign-in codes and links, receipts and purchase confirmations, payment and bandwidth warnings, copyright notices and replies to your support requests. If you subscribe to a filmmaker, one email the first time they publish a film ("New from <Filmmaker>: <Title>", with the poster, a line of synopsis, the price or "Free to watch" and a link); every subscriber gets it, in publish order, and nothing is sent for edits, republishing or removals. Each such email carries a one-click unsubscribe link that works without signing in. We do not send marketing email.
• To understand and improve the site: aggregate traffic measurement with Google Tag Manager and error monitoring.
• To measure our own advertising: when a visitor creates an account or pays for a plan, Google Tag Manager reports that event to Google Ads, together with a hashed version of the e-mail address and the click identifier Google attached to the advert, so we can tell which of our adverts led to sign-ups and subscriptions. The address itself is never sent.
• To meet legal obligations and to protect our rights, our users and the public.

We do not sell, rent or trade personal data, and we do not use your videos or data to train AI models.

Who receives your data

We share personal data only with the providers below, which process it on our behalf to run Vidreno, and in the legal situations that follow. We do not share it with anyone else.

• Cloudflare (R2 storage and Workers): stores video files, thumbnails and related assets and delivers them to viewers. When a video plays, Cloudflare sees the viewer's IP address and browser as part of serving the file.
• DigitalOcean: hosts the Vidreno application.
• A managed PostgreSQL database provider: holds the account, video, order and usage records described above.
• Polar (payments and merchant of record): handles plan subscriptions, bandwidth add-ons, advertiser credit packs and film purchases. Polar collects your card details and billing address; they never reach Vidreno. We receive your email, order references and amounts.
• PayPal: receives a creator's PayPal email address and the payout amount when we pay earnings by PayPal. Bank transfers are arranged manually by us using the encrypted details you supplied.
• Postmark: sends our transactional email (sign-in codes, confirmations, warnings, receipts) and therefore receives your email address and the message contents.
• Helpdesky: runs our help centre, the support widget and the ticket centre. Your support messages, name and email are stored there. When you read a tutorial on vidreno.com, your IP address and browser type are forwarded to Helpdesky so its view counts and rate limits apply per visitor.
• Sentry: error monitoring for the signed-in app and player, and for our server. Reports from your browser include browser and request details and the network address they come from. Reports from our server include the failing request's method, path and matched route, the response status, our server's environment and, if you were signed in, your account's numeric id — never request bodies, headers, cookies, tokens, e-mail addresses or network addresses.
• Google: Google Tag Manager loads on the website, the signed-in app, the player and embeds for aggregate traffic measurement, but not on the screen where you approve an AI assistant's connection; Google Fonts serves the site's typefaces. Both receive your IP address and browser details as part of loading. The tag container also runs Google Ads conversion measurement: when you create an account or pay for a plan, Google Ads receives that event (for a plan payment, the plan name, the amount and the currency), a SHA-256 hash of your e-mail address — computed in your browser; the address itself never leaves it — and the click identifier from the advert that brought you here (the gclid Google appends to the page address), and it may set its own cookies to connect your visit with the sign-up or payment. Google uses the hashed address only to match the event to the advert click. The tag container currently also loads an OpenAI measurement pixel, which receives the page address and browser details for advertising measurement.
• Vidreno's transcoding service: our own service that prepares adaptive-streaming versions of films. It receives the video file, not your personal details.
• Playback-licence services (when protected playback launches, and only for films whose filmmaker has turned protection on, see Protected playback): Vidreno's own licence server issues FairPlay and Widevine playback licences and receives the film, your entitlement and the device's licence request. For Widevine, that licence may be issued through a third-party licence-service provider acting on our behalf, which we will name here when it is chosen; nothing is sent to Apple for a FairPlay licence. A device's Widevine module may also contact Google once to be provisioned, which happens on the device under Google's own policy, not through Vidreno.
• OpenAI (automated title check): when the check is switched on, the title and file name of an upload, and nothing else, are sent to OpenAI to flag likely unauthorised copies of commercial releases.
• AI assistants you connect (for example ChatGPT or Claude): receive the account and video details listed under Connections to AI assistants, only after you approve the connection.

We may also disclose personal data where the law requires it (for example a valid court order), to enforce our Terms of Service, or to protect the rights, property or safety of Vidreno, our users or others. If Vidreno is ever acquired or merged, the data we hold would transfer under the same protections and you would be told.

How long we keep data

• Account data: for as long as your account exists. When you ask us to delete your account we remove it, along with your videos and the personal data linked to it, apart from the financial records listed below.
• Subscriptions to filmmakers: until you unsubscribe or either account is deleted (deleting an account removes its subscriptions both ways). Delivery records live as long as the film and the subscriber's account; a failed send is retried until it succeeds or the address rejects it permanently, and any send still waiting when you unsubscribe is cancelled rather than sent.
• Crew credits and invites: crew credits live as long as the film they belong to (deleting a film deletes its crew credits). The invite address and link are removed from a credit when it is accepted or re-assigned; an unused invite link expires after 30 days. A declined invite keeps the address on that credit so that no further invite is sent to it. Our record of when you sent invite emails (for the daily cap) is kept for 24 hours of use.
• Hosted videos: until you delete them. Deletion is immediate and permanent: the file, its thumbnail, any transcoded versions and the database record are removed at once, and there is no trash or recovery period.
• Unpaid subscriptions: if a plan payment fails, your videos are suspended 24 hours later and, if the payment is still outstanding 7 days after that, anything beyond the free allowance is permanently deleted.
• Abandoned uploads and unattached film assets: removed after 24 hours.
• View and ad-impression event logs (hashed IP address, hashed browser fingerprint, seconds watched): deleted after 30 days. The aggregate counts they produced are kept.
• Playback-licence requests (once protected playback launches): deleted after 30 days.
• Financial records: billed ad impressions and clicks, credit purchases, film orders, earnings and payouts are kept for as long as accounting and tax rules require, including after an account is deleted.
• Sign-in cookie: 7 days. Viewer cookie: 1 year.
• Sign-in codes and links: email login codes and magic links are valid for 10 minutes, the sign-up code in a registration confirmation for 10 minutes and its confirmation link for 60 minutes, password-reset links for 30 minutes, and the sign-in link in a film purchase confirmation for 7 days. A code or link cannot be used after it expires or after it has been used once; the record that it was issued (the address it went to, when, and whether it was used) currently stays in our database afterwards.
• AI assistant connections: access tokens last 1 hour; refresh tokens last 30 days and are renewed while the app is in use. We keep a connection's token records, including superseded ones (which is how a stolen, replayed token is detected), for as long as the connection is live; once it has ended, because its last token expired or you revoked it, all of its records are removed by a scheduled cleanup 7 days later. Unused browser upload hand-offs expire after 1 hour and are removed by the cleanup once they have been expired for 24 hours; a completed hand-off is kept as the record of which video it created.
• Support tickets: held in our help-desk provider for as long as we need them to support you; ask us if you want a ticket removed.
• Operational and error logs: kept only for a limited period and then discarded.

Connections to AI assistants

Creators can connect an AI assistant such as ChatGPT or Claude to their Vidreno account over the open Model Context Protocol (MCP). This section describes exactly what that connection involves.

• Nothing is shared until you approve. A connection exists only after you sign in to Vidreno and approve the app on Vidreno's own consent screen, which names the app, the permissions it asked for and the account it will connect to. Only creator accounts can connect.
• Nine permissions. films:read lets the app see your films; films:write additionally lets it create a new draft film from a title, change a film's details, extra links, release mode and prices, publish or unpublish it, manage its crew credits (adding, editing, reordering and removing them, converting director and cast lines into credits, and sending credit invites by e-mail or handing you an invite link), upload a main film or trailer and remove a trailer. profile:read lets the app see your filmmaker profile and the credits other filmmakers gave you; profile:write additionally lets it edit that profile, including its username and whether it is public, and accept, decline or unlink those credits. videos:read lets the app see your hosted videos and account summary; videos:write additionally lets it change, upload and delete hosted videos. earn:read lets the app see your earnings, balance, film sales, payout history and payout method in masked form; it is read-only, so no permission lets the app request a payout or change where you are paid. projects:read lets the app see your own projects (every field, their roles and pay, publish checklist, status and links), the applications to them with each applicant's public profile card, note, links and the messages in the thread, your own applications and their threads, and search the open roles of live public projects as anyone can on Projects; projects:write additionally lets it create, edit, publish and close your projects, add, change (including marking filled) and remove their roles, shortlist, accept or decline applicants and message them, and, on your behalf as an applicant, apply to open roles with a note and links, message the project owner and withdraw applications. It cannot invite people to a private project, upload a cover image, or take part in project discussions. You see each one on the consent screen and can approve a read-only connection.
• What the app receives. When you ask it to do something that needs the data, the app can receive: your account ID, email address and username; whether your account is set up for Films or for Host & Embed; your plan name, storage used and storage limit; the link to your public filmmaker profile and how many films you have; for each film its title, synopsis, director and cast lines, year, runtime, genres (and any older free-text genre still to be matched to the list), country of production, what it was shot on (capture format and camera), whether it was made as a student film, filming locations, the awards you listed with their verification status, IMDb link, draft/published status, whether it is free to watch or buy or rent and its prices, play count, main film and trailer processing state, publish checklist, public page and editor links, and its crew credits (role, name, position, linked username or invited e-mail address and invite status) and the invite links it mints; with the profile permission, your filmmaker profile as the Profile page shows it (username and why it cannot go public yet, display name, bio, location, roles, website and social links, whether you have an avatar, whether the profile is public and its public link) and the credits other filmmakers gave you (role and name as written, status, the film's title, status and public page, and the film owner's name); and for each hosted video its title, description, public/private setting, processing status, file size, duration, thumbnail, view count, daily view series, category, player colour, upload date and share, embed and management links, and, for a public video with ready adaptive quality versions, its direct HLS stream link (a permanent playback link anyone holding it can use; otherwise the reason there is none, such as a plan without adaptive quality); plus the status of uploads it started. With the projects permissions it can also receive: for each of your projects every field the Studio editor shows (title, logline, description, project type, format, stage, country and city or remote-friendly, shoot dates, links, previous work, whether it has a cover image, visibility, draft/live/closed status, review status and reason, publish checklist and the public and Studio links), its roles (role, department, how many people, description, pay, open or filled, application counts and public page), and the applications to it (status, note, links, dates, the messages in the thread with each sender's display name, and the applicant as their public filmmaker profile card: display name, handle, roles, location, website and social links and their public films, never their e-mail address); your own applications in the same shape with the project owner's public card; and, from the open-roles search, what any visitor sees on Projects (the role, its pay, the project summary and the owner's public card). With the earnings permission it can also receive: your lifetime and current-month earnings split into film sales and ad earnings; your balance (available, maturing, paid out and in flight); the payout minimum and hold period; whether ad earnings are live for your account; for each film its sales and refund counts, gross and net earnings; for each film order the film, whether it was a purchase or a rental, the price, Vidreno's cut, the processor fee (and whether it is still an estimate), paid or refunded status, the amount credited and the dates, never the buyer; each payout's amount, status, method, masked destination, request and payment dates and failure reason; and your payout method in masked form (for PayPal, the masked e-mail address; for a bank account, the bank name, country and last four digits only). That is the complete list.
• Films, projects, your profile, earnings and hosted videos only. Your film sales, earnings and payouts are read-only and only reachable with the separate earnings permission; the connection can never request a payout, change your payout method or see your full PayPal address or bank account numbers. It never reaches billing or payment details, buyer identities, advertiser data, or anyone else's account (other filmmakers appear only as the public profile cards that Projects shows everyone), and it cannot browse films publicly, upload a poster, a project cover or an avatar, or delete a film or a project.
• It acts only on your instructions. Renames, description edits, visibility changes, profile and credit changes, project, role and application changes (including the messages and decisions it sends to applicants or project owners as you), uploads and deletions happen only when you ask the assistant for them, and deletions and closing a project require your explicit confirmation first. If you attach a video file in the chat, Vidreno fetches it from the AI provider's temporary download link straight into your library; the file is not routed through the assistant itself.
• What Vidreno stores. The app's name, the permissions you approved, when it connected and was last renewed, and one-way hashes of its tokens. Vidreno does not receive or store your prompts or conversations with the assistant.
• Token lifetimes. Access tokens expire after 1 hour. Refresh tokens last 30 days and are renewed each time the app uses them; the superseded tokens stay on record while the connection is live so that a stolen copy being replayed can be detected and the whole connection shut down. Once a connection has ended, because its last token expired or you revoked it, all of its records are removed 7 days later. Browser upload links the assistant hands you expire after 1 hour and their records are removed once they have been expired for 24 hours.
• The AI provider's own policy applies. Whatever the assistant receives from Vidreno is then handled by the provider of that assistant (for example OpenAI or Anthropic) under its own privacy policy, including how long it keeps it in your chat history. Disconnecting stops future access but does not remove information already in your conversations.
• Disconnecting. Open Account Settings → Connected apps in Vidreno and disconnect the app, or remove the connection from the assistant's own settings. Disconnecting in Vidreno revokes the app's tokens at once; removing the connection on the assistant's side discards them there (apps that support token revocation also tell us), and the connection's records in Vidreno are removed 7 days after its last token expires.

Cookies and local storage

Vidreno uses a small number of first-party cookies. All but the last are necessary for the service to work:

• token: keeps you signed in for 7 days. HTTP-only, so scripts cannot read it.
• vid_viewer: a random identifier set when a video plays, lasting 1 year, used to count unique views and detect fraud. On the live site it is sent for embeds on other sites too (SameSite=None; Secure; Partitioned, so each embedding site gets its own copy); the player keeps the same identifier in local storage as well (see below).
• oauth_csrf: protects the AI-assistant consent screen against forged submissions; lasts 15 minutes.
• film_outcome: shows the result of a film purchase when you return from checkout; lasts 5 minutes.
• account_created: set once, when your account is created, so the app can report the sign-up to Google Ads on the first page it shows you (see below); it holds your account's number and type, and is removed as soon as that happens or after 1 hour at most.

Your browser's local and session storage hold the vid_viewer identifier described above (kept by the player for embeds on other sites), a flag that you have signed in before, the e-mail address and sign-in method (e-mailed code or password) you last used so the sign-in page can fill them in for you (cleared with "Not you?" on that page), unfinished advertiser campaign drafts, which ads and notices you have dismissed, and the references of plan payments already reported to Google Ads so that none is reported twice. None of this leaves your browser.

Third parties: Google Tag Manager runs on the website, app, player and embeds (not on the AI-assistant consent screen) for aggregate traffic measurement and, on the website and the app, for Google Ads conversion measurement of sign-ups and plan payments as described under Who receives your data; it may set its own cookies, including Google Ads cookies that connect a visit from one of our adverts with a later sign-up or payment. Google Fonts serves our typefaces; the Helpdesky support widget loads on our pages. You can block or delete cookies in your browser settings; the token cookie is required to stay signed in.

Your choices and controls

You can do the following yourself, right now:

• Change your email address and username in Account Settings.
• Set each video to public or private, and delete any video permanently.
• Unsubscribe from a filmmaker on your Subscriptions page, by pressing Subscribed on their page, or with the unsubscribe link in any new-film email (no sign-in needed).
• Disconnect any AI assistant from Account Settings → Connected apps.
• Dismiss ads shown in the app, and manage your payout details and campaigns from their own pages.

Through the contact form you can ask us to:

• Delete your account and the personal data linked to it (financial records are kept as described above).
• Send you a copy of the personal data we hold about you, or export your video content.
• Correct inaccurate information, restrict or object to processing, or withdraw a consent you gave.

We answer these requests within one month and will confirm your identity first. There is no charge unless a request is clearly unfounded or excessive. If you are unhappy with how we handle your data you can complain to the Isle of Man Information Commissioner, or to the data protection authority where you live.

Security

• All traffic between you, Vidreno and our providers is encrypted in transit (HTTPS).
• Passwords are stored as one-way hashes (bcrypt). AI-connection tokens, authorization codes and upload hand-off tokens are stored as one-way hashes too; the sign-in cookie is a signed token that is not stored at all. Email sign-in codes, sign-up codes, magic links and password-reset links are short-lived, single-use secrets and are stored as issued until they are used or expire.
• Bank account and routing numbers for payouts are encrypted with a key held separately from the database.
• Viewer records hold salted one-way hashes instead of IP addresses.
• Access to personal data is limited to the people who need it to operate the service.

No system is perfectly secure. If we learn of a breach affecting your personal data we will tell you and the relevant authorities as the law requires.

Children

Vidreno is not directed at children under 13 and we do not knowingly collect personal data from them. People aged 13 to 17 may use the service; if you are a parent or guardian and believe a child under 13 has given us personal data, contact us and we will delete it.

International transfers

Vidreno is based in the Isle of Man. The providers listed above process data in the European Union, the United Kingdom and the United States. Where personal data leaves the Isle of Man, the EU or the UK we rely on the data-protection terms and transfer safeguards those providers provide, so that it stays protected to the same standard.

Changes to this policy

When we change how we handle personal data we update this page and the date at the top. For significant changes we will also tell account holders by email or with a notice in the app.

Contact us

Questions or requests about this policy or your data: use the contact form and we will reply from our support desk.

Massive Monkey Ltd., Douglas, Isle of Man.